token_authenticate_me 0.4.3 → 0.5.0

data/lib/generators/token_authenticate_me/policies/policies_generator.rb

@@ -0,0 +1,15 @@
+module TokenAuthenticateMe
+  module Generators
+    class PoliciesGenerator < ::Rails::Generators::Base
+      source_root File.expand_path('../templates', __FILE__)
+
+      def create_invite_poliocy
+        copy_file 'invite_policy.rb', 'app/policies/token_authenticate_me/invite_policy.rb'
+      end
+
+      def create_user_poliocy
+        copy_file 'user_policy.rb', 'app/policies/token_authenticate_me/user_policy.rb'
+      end
+    end
+  end
+end

data/lib/generators/token_authenticate_me/policies/templates/invite_policy.rb

@@ -0,0 +1,31 @@
+module TokenAuthenticateMe
+  class InvitePolicy < ApplicationPolicy
+    def create?
+      record.owner_id == current_user.id || super
+    end
+
+    def show?
+      true
+    end
+
+    def update?
+      create?
+    end
+
+    def destroy?
+      record.owner_id == current_user.id || super
+    end
+
+    def accept?
+      current_user
+    end
+
+    def decline?
+      current_user
+    end
+
+    def permitted_attributes
+      [:email, :accepted, :meta]
+    end
+  end
+end

data/lib/generators/token_authenticate_me/policies/templates/user_policy.rb

@@ -0,0 +1,23 @@
+module TokenAuthenticateMe
+  class UserPolicy < ApplicationPolicy
+    def create?
+      true
+    end
+
+    def show?
+      true
+    end
+
+    def update?
+      record.id == current_user.id || super
+    end
+
+    def destroy?
+      record.id == current_user.id || super
+    end
+
+    def permitted_attributes
+      [:username, :email, :password, :password_confirmation]
+    end
+  end
+end

data/lib/tasks/token_authenticate_me_tasks.rake

@@ -0,0 +1,4 @@
+# desc "Explaining what the task does"
+# task :token_authenticate_me do
+#   # Task goes here
+# end

data/lib/token_authenticate_me.rb

@@ -1,6 +1,17 @@
 require 'token_authenticate_me/engine'
 require 'token_authenticate_me/version'
+require 'token_authenticate_me/configuration'
 
 module TokenAuthenticateMe
+  extend self
+
   UUID_REGEX = /([a-f0-9]){32}/
+
+  def configure
+    yield configuration
+  end
+
+  def configuration
+    Configuration.instance
+  end
 end

data/lib/token_authenticate_me/concerns/controllers/invitable.rb

@@ -0,0 +1,58 @@
+require 'api_me'
+
+module TokenAuthenticateMe
+  module Concerns
+    module Controllers
+      module Invitable
+        extend ActiveSupport::Concern
+
+        include TokenAuthenticateMe::Controllers::TokenAuthenticateable
+        include ApiMe
+
+        included do |_base|
+          skip_before_action :authenticate, only: [:show]
+
+          def create
+            @object = model_klass.new(object_params)
+            authorize @object
+            @object.save!(object_params)
+
+            TokenAuthenticateMeMailer.invite_email(
+              @objec5,
+              request.base_url
+            ).deliver_later
+            render status: 201, json: @object, serializer: serializer_klass
+          rescue ActiveRecord::RecordInvalid => e
+            handle_errors(e)
+          end
+
+          def accept
+            @object = model_klass.find(params[:id])
+
+            if @object.accepted.nil?
+              ActiveRecord::Base.transaction do
+                @object.accept!(current_user)
+                @object.update!(accepted: true)
+              end
+
+              render status: 204, nothing: true
+            else
+              render json: { message: 'The request has already been processed' }, status: 422
+            end
+          end
+
+          def decline
+            @object = model_klass.find(params[:id])
+
+            if @object.accepted.nil?
+              @object.update!(accepted: false)
+              render status: 204, nothing: true
+            else
+              render json: { message: 'The request has already been processed' }, status: 422
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/token_authenticate_me/concerns/controllers/password_resetable.rb

@@ -0,0 +1,97 @@
+require 'active_support/concern'
+
+require 'token_authenticate_me/concerns/controllers/token_authenticateable'
+
+module TokenAuthenticateMe
+  module Concerns
+    module Controllers
+      module PasswordResetable
+        extend ActiveSupport::Concern
+
+        include TokenAuthenticateMe::Concerns::Controllers::TokenAuthenticateable
+
+        included do
+          skip_before_action :authenticate, only: [:create, :update]
+          before_action :validate_reset_token, only: [:update]
+
+          # Send reset token to user with e-mail address
+          def create
+            @user = User.find_by_email(params[:email])
+
+            if @user
+              send_valid_reset_email(@user)
+            else
+              send_invalid_reset_email(params[:email])
+            end
+
+            render status: 204, nothing: true
+          end
+
+          # Allow user to reset password when the token is valid
+          # and not expired
+          def update
+            @user.update!(
+              password: params[:password],
+              password_confirmation: params[:password_confirmation],
+              reset_password_token: nil,
+              reset_password_token_exp: nil
+            )
+
+            render status: 204, nothing: true
+          rescue ActiveRecord::RecordInvalid => e
+            handle_errors(e)
+          end
+
+          private
+
+          def send_valid_reset_email(user)
+            user.create_reset_token!
+
+            TokenAuthenticateMeMailer.valid_user_reset_password_email(
+              request.base_url,
+              user
+            ).deliver
+          end
+
+          def send_invalid_reset_email(email)
+            TokenAuthenticateMeMailer.invalid_user_reset_password_email(
+              request.base_url,
+              email
+            ).deliver
+          end
+
+          def session_params
+            params.permit(:password, :password_confirmation)
+          end
+
+          def render_errors(errors, status = 422)
+            render(json: { errors: errors }, status: status)
+          end
+
+          def handle_errors(e)
+            render_errors(e.record.errors.messages)
+          end
+
+          def validate_reset_token
+            valid_reset_token? || render_not_found
+          end
+
+          def render_not_found
+            render status: 404, nothing: true
+          end
+
+          def valid_reset_token?
+            # Check for
+            # https://github.com/rails/rails/commit/e8572cf2f94872d81e7145da31d55c6e1b074247
+            # security issue when config.action_dispatch.perform_deep_munge = false is set
+            # which is common for JSON APIs
+            return false if params[:id].class == Array || params[:id].nil?
+
+            @user = User.find_by_reset_password_token(params[:id])
+            @user && @user.reset_password_token_exp > DateTime.now
+          end
+        end
+      end
+    end
+  end
+end

data/lib/token_authenticate_me/concerns/controllers/sessionable.rb

@@ -0,0 +1,55 @@
+require 'active_support/concern'
+
+require 'token_authenticate_me/concerns/controllers/token_authenticateable'
+
+module TokenAuthenticateMe
+  module Concerns
+    module Controllers
+      module Sessionable
+        extend ActiveSupport::Concern
+
+        include TokenAuthenticateMe::Concerns::Controllers::TokenAuthenticateable
+
+        included do
+          skip_before_action :authenticate, only: [:create]
+          after_action :cleanup_sessions, only: [:destroy]
+
+          def create
+            resource = User.where('username=? OR email=?', params[:username], params[:username]).first
+            if resource && resource.authenticate(params[:password])
+              @session = Session.create(user_id: resource.id)
+              render json: @session, status: 201
+            else
+              render json: { message: 'Bad credentials' }, status: 401
+            end
+          end
+
+          def show
+            @session = authenticate_token
+            render json: @session
+          end
+
+          def destroy
+            authenticate_token.destroy
+
+            render status: 204, nothing: true
+          rescue
+            render_unauthorized
+          end
+
+          private
+
+          def session_params
+            params.permit(:username, :email, :password)
+          end
+
+          def cleanup_sessions
+            ApiSession.where('expiration < ?', DateTime.now).delete_all
+          rescue
+            Rails.logger.warn 'Error cleaning up old authentication sessions'
+          end
+        end
+      end
+    end
+  end
+end

data/lib/token_authenticate_me/concerns/controllers/token_authenticateable.rb

@@ -0,0 +1,45 @@
+require 'active_support/concern'
+
+module TokenAuthenticateMe
+  module Concerns
+    module Controllers
+      module TokenAuthenticateable
+        extend ActiveSupport::Concern
+
+        included do
+          before_action :authenticate
+        end
+
+        protected
+
+        def authenticate
+          authenticate_token || render_unauthorized
+        end
+
+        def current_user
+          if authenticate_token
+            @current_user ||= User.find_by_id(authenticate_token.user_id)
+          end
+        end
+
+        def authenticate_token
+          @session ||= authenticate_with_http_token(&method(:token_handler))
+        end
+
+        def render_unauthorized
+          headers['WWW-Authenticate'] = 'Token realm="Application"'
+          render json: 'Bad credentials', status: 401
+        end
+
+        def token_handler(token, _options)
+          session = TokenAuthenticateMe::Session.find_by_key(token)
+          if session && session.expiration > DateTime.now
+            session
+          else
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/token_authenticate_me/concerns/models/authenticatable.rb

@@ -0,0 +1,102 @@
+require 'active_support/concern'
+
+module TokenAuthenticateMe
+  module Concerns
+    module Models
+      module Authenticatable
+        extend ActiveSupport::Concern
+
+        included do
+          has_secure_password validations: false
+          attr_accessor :current_password
+
+          has_many :sessions
+          has_many :invites, inverse_of: 'creator', foreign_key: 'creator_id'
+
+          validates(
+            :email,
+            presence: true,
+            uniqueness: { case_sensitive: false },
+            format: {
+              with: /\A([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})\z/i,
+              message: 'invalid e-mail address'
+            }
+          )
+
+          validates(
+            :username,
+            format: { with: /\A[a-zA-Z0-9]+\Z/ },
+            presence: true,
+            uniqueness: { case_sensitive: false }
+          )
+
+          validates(
+            :password,
+            presence: true,
+            length: { in: 8..72 },
+            confirmation: true,
+            if: :password_required?
+          )
+
+          validate(
+            :current_password_correct,
+            if: :current_password_required?
+          )
+
+          def attributes
+            {
+              'id' => id,
+              'username' => username,
+              'email' => email,
+              'created_at' => created_at,
+              'updated_at' => updated_at
+            }
+          end
+
+          def as_json(options = nil)
+            { user: super(options) }
+          end
+
+          def create_reset_token!
+            # rubocop:disable Lint/Loop
+            begin
+              self.reset_password_token = SecureRandom.hex
+            end while self.class.exists?(reset_password_token: reset_password_token)
+
+            self.reset_password_token_exp = password_expiration_hours.hours.from_now
+            save!
+          end
+
+          def password_expiration_hours
+            8
+          end
+
+          def password=(unencrypted_password)
+            super(unencrypted_password) unless unencrypted_password.blank? && !password_required?
+          end
+
+          def current_password_correct
+            errors.add(:current_password, 'is required to change email and/or password') if current_password.blank? # rubocop:disable Metrics/LineLength
+            errors.add(:current_password, 'is incorrect') unless authenticate(current_password)
+          end
+
+          def current_password_required?
+            !new_record? && (email_changed? || attempting_to_change_password?) && !password_resetting?
+          end
+
+          def password_resetting?
+            reset_password_token_changed? && reset_password_token_exp_changed?
+          end
+
+          def password_required?
+            attempting_to_change_password? || new_record?
+          end
+
+          def attempting_to_change_password?
+            (!password.blank? || !password_confirmation.blank?) && password_digest_changed?
+          end
+        end
+      end
+    end
+  end
+end